- Test - lists.nanog.org

DNSSEC in public
by Dan Mahoney, System Admin 12 Sep '05

12 Sep '05

In response to a recent question I saw regarding DNSSEC on RIPE domains, I'd like to ask if there's any sort of draft or standard that anyone knows about for doing DNSSEC in the public, using either a "root" key and/or possibly having master keys pulished in WHOIS? I see a very experimental thing Verisign is doing for the .net zone, and also for some other opt-in zone, but I'm sure that's highly experimental at this point. I guess my question is: is there even something up for discussion at this point? I know it's early in the game. Thanks Dan -- "I can feel it, comin' back again...Like a rolling thunder chasin' the wind..." -Dan Mahoney, JS, JB & SL, May 10th, 1997, Approx 1AM --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

5 4

DHS Cyber Security Investment Study
by Rowe, Brent 12 Sep '05

12 Sep '05

NANOG members, I am writing to ask for your participation in a study which I am working on for the Department of Homeland Security on IT security investment decisions. My intension is not to upset anyone with an unwanted solicitation, so if you are uninterested in this topic, please disregard the remainder of this email. ------------------------------------------------------------------------ ------------------ My company, RTI, has been contracted by the the Department of Homeland Security to analyze how organizations make investment decisions related to IT security. As part of this project, we are gathering information from organizations in seven different sectors, one of which is Internet Service Providers. I am interested in talking with any individuals representing ISPs about their organizations' IT security decision making practices. Let me be clear that I are not interested in learning the makeup of your IT infrastructure, the IT policies and procedures your organization employs, the number of breaches you have each year, or any other sensitive information related to your organization's IT security. Instead, I am interested in discussing the information you use to decide how much to spend on various IT security-related activities and what information you are collecting (and using) from your IT system operations. If you are interested in participating in this study and/or have questions related to how we plan to use the data we collect, the purpose of the study, or the intended use of the study results, please contact me at browe(a)rti.org or 919-485-2626. Thank you any assistance you can provide. Regards, Brent Brent Rowe Research Economist Technology Economics & Policy RTI International 3040 Cornwallis Road Research Triangle Park, NC 27709 phone: (919) 485-2626 fax: (919) 541-6683 www.rti.org

3 2

Re: Katrina Network Damage Report
by Valdis.Kletnieks＠vt.edu 12 Sep '05

12 Sep '05

On Mon, 12 Sep 2005 12:26:03 EDT, "Howard, W. Lee" said: > Maybe I missed an intermediate post or two, but is the assertion > here that IPv6 is more secure because it's impractical to scan such > a large number of possible host IP addresses? Sort of like zebra > camouflage--it's easy to see the herd, but hard to see a single > zebra. > > There may be other ways to find a host address than random botting. > Phishing, perhaps. The good news here is that although there's "neighbor discovery protocols" that let you find the other zebras on the subnet, they only work if you're already riding a zebra in the herd. If you're riding a giraffe or hippo, or a zebra from another herd, you still can't see the zebras. Now if we could just do some genetic engineering to cull this mutation that causes zebras to spontaneously sprout big neon "Ride Me" signs..... (In other words, yes - we *will* see a shift in tactics from "random scanning" to "find a vulnerable host on the subnet, and use it to enumerate the other hosts". I predict that web bugs and spam variants will be the method of choice for finding that first host.....)

1 0

MEDIA: eBay to Acquire Skype
by william(at)elan.net 12 Sep '05

12 Sep '05

Let me play Paul Ferguson for a second ... : (and I wonder if we'll soon be trading voip minutes on ebay :) http://finance.lycos.com/home/news/story.asp?story=51709287 eBay to Acquire Skype - Sep 12, 2005 06:00 AM (BusinessWire) LONDON--(BUSINESS WIRE)--Sept. 12, 2005--eBay Inc. (Nasdaq:EBAY) www.ebay.com) has agreed to acquire Luxembourg-based Skype Technologies SA, the global Internet communications company, for approximately $2.6 billion in up-front cash and eBay stock, plus potential performance-based consideration. The acquisition will strengthen eBay's global marketplace and payments platform, while opening several new lines of business and creating significant new monetization opportunities for the company. The deal also represents a major opportunity for Skype to advance its leadership in Internet voice communications and offer people worldwide new ways to communicate in a global online era. Skype, eBay and PayPal will create an unparalleled ecommerce and communications engine for buyers and sellers around the world. ...

2 1

RE: Katrina Network Damage Report
by Joel Jaeggli 12 Sep '05

12 Sep '05

On Mon, 12 Sep 2005, Howard, W. Lee wrote: > Maybe I missed an intermediate post or two, but is the assertion > here that IPv6 is more secure because it's impractical to scan such > a large number of possible host IP addresses? Sort of like zebra > camouflage--it's easy to see the herd, but hard to see a single > zebra. I didn't assert that it was more secure, rather that scanning as it works now, to collect the ip's of exploitable embedded or other devices is infeasible. Miscreants will of course looks for other ways if they can't feasibly scan. The IETF is full of resource discovery mechanism work and there's no reason to expect that those selfsame mechanisms wouldn't be subverted to other ends. There's no point in conneccting a device to the internet if you can't find it or manange it. As my firewall logs would testify though, host discovery throught probing is one of the low hanging fruit. > There may be other ways to find a host address than random botting. > Phishing, perhaps. > > I suppose the relative security question becomes, "Which is more > secure: address translation or sparseness?" I've heard people say > that NAT provides no security, but dynamic assignment (from the > Internet's point of view) of an address for only the duration of > a session means you can't target a specific host, and have to have > some access already to hijack a session. > > I'm not saying NAT is sufficient security, but it can be part of > a good plan. Obscurity isn't sufficient security, but I'm not > publishing my network map. > > Lee > > > > -- -------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja(a)darkwing.uoregon.edu GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2

1 0

Re: Multi-6 [WAS: OT - Vint Cerf joins Google]
by Brandon Butterworth 12 Sep '05

12 Sep '05

> >> 1. Give us a maximum number of multihomers. > > > 4 Million > > So how do you know it's 4 million and not 4.1? Could be 4.1 or even 4.2. I'm assuming those working on 4byte ASs know, if it's more we'll have to migrate again which would be silly so soon So about 4M it must be. > We know that 125k works today That's quite a bit less than current SUP720-3BXL > (I'm being a bit conservative because > in IPv6 the addresses are longer) so the storage requirements should > sort themselves out according to Moore in 7 x 1.5 years, so that > would work in 2013. Processing scales non-linearly, though. If we need it then it will exist, if not then we won't be able to do that and will do something else instead just as V4 users are doing when they discover V6 doesn't do what they want (let's not rehash whether what they want is reasonable or sensible) brandon

2 1

[db-wg] DNSSEC deployment on the reverse tree. (fwd)
by william(at)elan.net 12 Sep '05

12 Sep '05

FYI - RIPE seems to be getting ready to deploy DNSSEC on inaddr (rdns) tree so I thought nanog folks might want to know about it too being the kind operational issue that we don't seem to be discussing here lately quite as much... BTW - are there any plans to deploy DNSSEC for ARIN ip dns tree and if so when are the good people at ARIN planning to tell about it? And perhaps presentation about DNSSEC on ip dns tree and how it is being handled and what we should be ready for maybe good to have at upcoming NANOG meeting. ---------- Forwarded message ---------- Date: Mon, 12 Sep 2005 09:39:48 +0200 From: Henk Uijterwaal <henk(a)ripe.net> To: dns-wg(a)ripe.net, db-wg(a)ripe.net Subject: [db-wg] DNSSEC deployment on the reverse tree. Dear Colleagues, In June, Olaf Kolkman wrote: > The RIPE NCC has been involved with the development of the DNSSEC > protocol. Now that the protocol has become available, we plan to > implement DNSSEC on our domains in the reverse DNS tree. The > deployment of DNSSEC is the second and last phase of the Reverse DNS > restructuring project. [...] > We welcome your feedback on this poposal before 1 August 2005. Please > send your comments to the DNS Working Group Mailing List. The comment period was extended to 1 September and some comments were posted to the list. These have all been incorporated and the new documents are at: > You can find the proposed policy at: > > <http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html>http://www.ripe.net/rs/reverse/dnssec/draft-dnssec-policy.html. > "DNSSEC Key Maintenance Procedure" > > <http://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html>http://www.ripe.net/rs/reverse/dnssec/key-maintenance-procedure.html > "Procedure for Requesting DNSSEC Delegations" > > <http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html>http://www.ripe.net/rs/reverse/dnssec/registry-procedure.html I'm going to suggest to the chairs of the WG to do a last call on these documents and have them published as RIPE documents. Kind regards, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(at)ripe.net RIPE Network Coordination Centre http://www.amsterdamned.org/~henk P.O.Box 10096 Singel 258 Phone: +31.20.5354414 1001 EB Amsterdam 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ Look here junior, don't you be so happy. And for Heaven's sake, don't you be so sad. (Tom Verlaine)

1 0

Re: Katrina Network Damage Report
by JORDI PALET MARTINEZ 12 Sep '05

12 Sep '05

While I agree that all kind of consumer devices will be most probably the first application of IPv6 at every home, office, etc., the BIG usage will come from sensors of all kinds. Probably will count by thousands at every place. I'm sure that we will never fill in the 64 bits address space of most of the subnets, but what it seems a waste of bits is actually a feature for autoconfiguration, cryptography and other usages still to come. And yes, we need easy autoconfiguration for so many IP-gadgets. Autoconfiguration also means that their are not numbered one after the other ... And yes, having more addresses means also that every device can turn on end-to-end security, which is already an improvement versus today Internet with IPv4+NAT. Regards, Jordi > De: Suresh Ramasubramanian <ops.lists(a)gmail.com> > Responder a: <ops.lists(a)gmail.com> > Fecha: Mon, 12 Sep 2005 08:05:51 +0530 > Para: "Valdis.Kletnieks(a)vt.edu" <Valdis.Kletnieks(a)vt.edu> > CC: Joel Jaeggli <joelja(a)darkwing.uoregon.edu>, Alan Spicer > <a_spicer(a)bellsouth.net>, Steve Gibbard <scg(a)gibbard.org>, <nanog(a)nanog.org> > Asunto: Re: Katrina Network Damage Report > > > On 12/09/05, Valdis.Kletnieks(a)vt.edu <Valdis.Kletnieks(a)vt.edu> wrote: >> A /48 is 80 bits of address. 1,208,925,819,614,629,174,706,176 addresses. >> Even at a million packets/second (which even Joe Sixpack will quite likely >> notice until such time as the Linksys router you get at Walmart does 1M pps), >> that's still 38,334,786,263 years of scanning. Of course, that's about >> 20 billion years after the Sun runs out of hydrogen and goes red giant and >> incinerates the planet.... >> >> Now how big a pile of toasters were you planning to use? > > I'm not planning to use any. I was just assuming that people who > promote v6 as the best thing since sliced bread, and needed because v4 > space is really really scarce now, are going to actually find enough > toasters, printers, phones, computers or whatever to fill all those > /48s that are getting allocated. > > And of course, as I said, small end sites are getting allotted /48s > through tunnelbrokers and such > > So the number of hosts in there is going to be highly limited and all > that /48 worth of IPs are going to wind up bound to the same host, or > the same LAN .. with IPs that are much closer to each other. > > Once you find a host on a /48 jump to the next one I guess. Or make > some guess on what IP addressing scheme is being followed and which > subnets of that /48 are being used [assuming that an end site like a > cellphone carrier decides to give v6 IPs to all its phone users] ... > scan from within the network. > > Unless you say that v6 space is ever going to be as densely populated > as v4 where each IP is often a different host, possibly several miles > apart rather than in the next rack. > > -- > Suresh Ramasubramanian (ops.lists(a)gmail.com) ************************************ The IPv6 Portal: http://www.ipv6tf.org Barcelona 2005 Global IPv6 Summit Information available at: http://www.ipv6-es.com This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

2 1

Re: OT - Vint Cerf joins Google
by George William Herbert 12 Sep '05

12 Sep '05

>How widespread *is* IPv6 adoption, anyhow? It's easier convincing some people to have root canals or elective brain surgery than to broach the subject of their software gaining IPv6 compatibility. It's really annoying. It shouldn't be this hard. -george william herbert gherbert(a)retro.com

2 1

Re: Multi-6 [WAS: OT - Vint Cerf joins Google]
by Brandon Butterworth 11 Sep '05

11 Sep '05

> 1. Give us a maximum number of multihomers. 4 Million > 2. Tell us how a routing table of that size (assuming 1 route per AS) > will scale based on reasonable extrapolations of today's technology. SUP720-3BXL says 1M (500K v6) now, doesn't seem too much of a stretch to 4M over many years brandon

2 1